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UE Power-on and Network Access Procedure 


e PLMN search (cell search) |] When the UE is powered on, its 


primary task is to find and contact the network. In essence, it is a 


downlink synchronization process. 


e System message receiving || The subsequent admission and 


camping procedures can be performed only after Layer 2 and Layer 1 


are configured. 

e Random access |] Eliminate contention between different UEs and 
achieve uplink synchronization. 

e Attach |] Establish the same mobility context between the UE and (scat ine EE 1 
the MME and the default bearer between the UE and the PDN 
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e Common Processes |] Authentication process and security mode 
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Location and Function of Cell Search 
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Cell search 


Basic principles of cell search [] 


a Cell search is a process in which the UE 
implements downlink time-frequency 
synchronization with the E-UTRAN and 
obtains the serving cell ID. 


a The cell search consists of two 
steps. [I 


Step 1: The UE demodulates the primary 


synchronization signal (PSS) to 
implement symbol synchronization and 
obtains the ID of the cell group [] 


Step 2: The UE demodulates the SSS to 
implement frame synchronization, 

obtains the CP length and cell group ID, 
and obtains the PC (((4))) on 
the cell gf ISA 


es 


o 
br 


The complete search process of the UE from power-on is as 
follows: 
a After the UE is powered on, it starts initial cell search and network 
search. Generally, when the UE is powered on for the first time, the 
UE does not know the bandwidth and frequency of the network. 


a The UE repeats the basic cell search process and traverses all 
frequencies in the entire spectrum to demodulate synchronization 
signals. This process is time-consuming, but generally does not 
have a strict time requirement.Some methods can be used to 
shorten the UE initialization time. For example, the UE stores the 
available network information and preferentially searches for these 
networks and frequencies after being powered on. 


a Once the UE finds an available network and implements 
time-frequency synchronization with the network to obtain 
the serving cell ID, that is, after the cell search is complete, 
the UE demodulates the downlink broadcast channel PBCH 
and obtains system information such as the system 
bandwidth and the number of transmit antennaSsuawei Confidential 


Functions of each system message 


System Information Broadcast 


The master information block includes a limited number of most important and commonly 
used transmission parameters that require additional information to be obtained in the cell 


MIB 


SIB 1 Includes scheduling information of other SIBs and access information of other 
cells. 
SI The SI carries the scheduling information of the SIB instead of SIB1. (cam) 


Cell radio configuration and other basic configuration information 


Cell reselection information, mainly related to the serving cell 


RRC_MASTER_INFO_BLOCK 
RRC SIB TYPE! 


PBCH:MIB 


Intra-frequency neighboring cell list and blocklist 


Inter-f ighbori Il list PDSCH:SIB1 
nter-frequency neighboring cell lis RRC SYS INFO 


UTRAN neighboring cell list PDSCH:SI Messages 
GSM neighboring cell list 
CDMA2000 neighboring cell list 
Home eNB Identifer 
ETWS Notification 
ETWS Auxiliary Notification Information 


CMAS auxiliary notification information 


MBMS control information 
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System message receiving flow instance 


emm, Te 
1 2010-09-13 18:57:29(1874342) RRC MASTER INFO BLOCK [—SEND 


2 [2010-09-13 18:57.29(1874555) [RRC SIB TYPE! [SEND 
3 [2010-09-1318:57:29(1874705) JRRC SYS INFO \ [SEND 
4 12010-09-1318:58:53(3794816) /|RRC_MASTER_INFO_BLOCK [SEND 


phich-Duration:normal (0) 
phich-Resource:one (2) 


23 [2010-09-73 19:00:08(4687887) __|RRC_CONN_RECFG|> — rn == 
34 12010-0913 19:00:08(4702218)  IRRC CONN RECFG) ` edulinginfoList | 


NXID:7B8F 


Sl V Schedulinginfo 
si-Periodicity.rfl 6 (1) 
= w sib-Mappinginfo 


csg-Indication FALSE 
Ee Y SIB1MSIB2 w cellSelectioninfo 
SR CSIBBSiR 


Bia ES. 


| 

| 

| cellldentity:0111101110001111111100000000(7B BF FO 00 
| cellBarred:notBarred (1) ——>/]\ K 3G HR IE 

i intraF reqReselection:allowed ()— Kifini 

| 

| 


5 [2010-09-13 18:58:53(3795021) / [RRC_SIB_TYPE1 \ [SEND 
6 [2010-09-1318:58:53(3795156y  [RRC_SYS_INFO \ [SEND 
7 2010-09-19 10:59:57(4700171 RRC_CONM_RCG RCCCIVC r i 
A = e = “Y PLMN-Identityinfo | 
8  [2010-09-1318:59:57(47829/1) IRRC_CONN_REQ \RECEIVE | à Y pimn-ldentity SIBABAS | 
9 [2010-09-13 18:59:57(4786Y50) IRRC_CONN_SETUP SEND | 
10 [2010-09-13 18:59:57(4787336)  [RRC_CONN_SETUP SAND 
11 [2010-09-13 18:59:57(4790348)  [RRC_CONN_REQ REGEIVE | 
12 (2010-09-13 18:59:57(4794606)  [RRC_CONN_SETUP SEND | 
13 | 2010-09-13 18:59:57( 7311245) RRC CONN SETUP CMP RECEN | MCC-MNC-Digit:0x6 (6) 
14 |2010-09-13 18:59:58/4855486) RRC_SECUR_MODE_CMD SEND \ | MCC-MNC-Digit:0x0 (0 
15 [2010-09-13 18:59:58(4871 342) RRC_SECUR_MODE_CMP RECEIVE | 
16 [2010-09-13 18:59,68(4872023) RRC UE CAP ENQUIRY SEND \ | 
2010-09-13 18:59:58(4886215) RRC_UE_CAP_INFO RECEIVE | 
18 (2010-09-13 18:99:58(4903395) RRC_CONN_RECFG SEND AA | MCC-MNC-Digit:0x0 (0) MNC:01 
19 (2010-09-13 19/59:58(4920368) RRC_CONN_RECFG_CMP RECEIVE | Y MNC-Digit Ox 3 
20 [2010-09-13 18:59:58(4924011) RRC_CONN_RECFG SEND | cellReservedForOperatorUse notReserved (1 
21 |2010-09-13/8:59:58(4924691) RRC_UL_INFO_TRANSF RECEIVE trackingAreaCode:0000000000100001(00 21) 
22 (2010-08-14 16.99.90(4930404) | RRC_CONN_RECFO_CMP [RECEIVE TAC:21 


| RR BNE er 
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Random Access Overview 


O Purpose of Random Access 
° Obtain upstream synchronization. 
e Obtaining Uplink Data Resources 


O Random Access Scenario 

1) Initial Access from Idle Mode to Connected Mode 
2) Access after radio link failure 

3) Access During Handover 


4) When the UE is in connected mode, uplink out-of-synchronization and 


downlink data arrives. 


5) When the UE is in RRC CONNECTED mode, uplink data arrives after uplink 
out-of-synchronization. 

6) Case6[] LCS [] LoCation Services [] Location-triggered random access. 

Random access is classified into contention-based random access and non- 


contention-based random access. Contention-based random access applies to 


scenarios 1, 2, and 5, and non-contention-based random access applies to 
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Random Access Overview 


After the contention-based random access succeeds, the RRC layer of the UE generates an RRC 
ConnectionSetupComplete and sends the RRC ConnectionSetupComplete message to the eNodeB.The difference 
between non-contention-based access and contention-based access is that the eNodeB allocates access 

UE 


I i : eNB 
preambles. THIS reduces contention and Ebnflict resolution. 


(1) Random Access Preamble © RA Preamble assignment 
AMSG10 (MSG1) 
Random Access Response] (2) 
Random Access Preamble 
UMSG2 |] (MSG2) 3 (2) 
(3) Scheduled Transmission 
LU MSG3 [] © Random Access Response 
(MSG3) 


Contention Resolution 


O MSG4 [] 
non-contention-based random access 


contention-based random access(CBRA) The eNodeB allocates access preambles to UEs. These 


Access preambles are generated by UEs. access preambles are dedicated preambles.In this case, no 


Preambles generated by different UEs may preamble collision occurs on the UE.However, when the 


conflict. Therefore, the eNodeB needs to 


dedicated preambles of the eNodeB are used up, non- 


contention-based random access becomes contention- 


based random access. Page9 Huawei Confidential 


O gontend for access of different UEs. 


Random Access Signaling Procedure 


(za) 7 
ULL UE eNodeB À / 
= (gn) r e N: RA Preamble ` ` | 
= eNodeg À __ PBACH arr Preamble<>TC-RNTI 
> mae co IDL Alloc. To RA-RNTI 
Random Access Preamble L=-77 PDCCTI Le sat 
__DL-SCH: RA Response `, 
Random Access Response Je - PDSCI EE le ID. TC RATI,TA-UL Grant 
First Scheduled UL pe PUSCH UL-SCH: RRC Connection Re 
Transmission est ST 3 oe 
PHICH HE EE rer 
Contention Resolution WA PDCCH , Alloc To TC-RNTI - .2.2.2.2000 
Ee is PDSCH PLSCH: E Connection gatik 
elen seria + SRRI Codines RLOMACPHY 
AS $ ONE GO 
PUCCH LHARQ ACR 
Ppccu | UL Allee. To C-RNTI 
USE: UL-SCH: RRC Conn. Setup Com Rout NAS Message 
E e MME Selected PLMN ID to Selected MME 


e NAS Mesage 
PHICH HARO ACK 


remark [] 

e Solid lines are visible signaling on the LMT 

eThe dotted line indicates the control signaling that is invisible on the 
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Basic Concepts of Attach Detach 


O The attach procedure is that the UE sends an attach request to the CN, 
completes the registration of the UE with the network, and completes the 
establishment of the default bearer for the UE by the EPC. 

O Detach is to deregister the UE on the network side and delete all EPS bearers. 


O Functions of the attach procedure 

° The UE registers with the EPS network. 

° During network attach, a default EPS bearer is set up to provide a permanent IP connection. 

° The MM context and EPS bearer context of the UE are created on the MME and UE.The EPS bearer 
context of the UE is created on the S-GW and P-GW.Default bearer between the UE and the P-GW; 
The UE can obtain the IP address allocated by the network. 
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Attach process 


Attach Accept. Activate default EPS 
bearer context request A 


REC Connection Reconfig. (112 
Attach Accept. Activate default EPS 
bearer context request) 


EEC Connection Reconfiz. complet 


Initial context setup response 


UL direct transfer I Attach Accept. 


Active default EPS bearer context accept ) a? LINAS transport iE S Stach Accept. 


Active default EPS bearer context accept ) 
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Description of the attach procedure 


1. The UE in the RRC IDLE state initiates a random access procedure, that is, an MSG1 message. 
. After detecting the MSG1 message, the eNB sends a random access response message, that is, the MSG2 message, to the UE. 


3. After receiving the random access response, the UE adjusts the uplink transmission occasion based on the TA of Msg2 and sends an 
RRCConnectionRequest message to the eNodeB. 


4. The eNB sends an RRCConnectionSetup message to the UE, including SRB1 bearer setup information and radio resource 
configuration information. 

5. The UE completes SRB1 bearer and radio resource configuration and sends an RRCConnectionSetupComplete message to the 
eNodeB. The message contains NAS-layer Attach Request information. 

6. The eNodeB selects an MME and sends an Initial UE MESSAGE message containing the NAS Attach Request message to the MME. 


7. The MME sends an Initial Context Setup Request message to the eNodeB, requesting to set up a default bearer. The message 
includes the Attach Accept and Activate default EPS bearer context request messages at the NAS layer. 


8. The eNodeB receives an Initial Context Setup Request message. If the message does not contain UE capability information, the 
eNodeB sends a UECapabilityEnquiry message to the UE to query the UE capability. 


9. The UE sends a UECapabilityinformation message to the eNodeB to report the UE capability information. 
10.The eNodeB sends a UE Capability INFO INDICATION message to the MME to update the UE capability information of the MME. 


11.The eNodeB sends a SecurityModeCommand message to the UE for security activation based on the security information supported 
by the UE in the Initial Context Setup Request message. 


12The UE sends a SecurityModeComplete message to the eNB, indicating that the security activation is complete. 

13.The eNodeB sends an RRCConnectionReconfiguration message to the UE based on the E-RAB setup information in the Initial 
Context SETUP REQUEST message to reconfigure UE resources, including reconfiguring SRB1 and radio resource configurations, and 
setting up SRB2 and DRBs (including default bearers). 

14.The UE sends an RRCConnectionReconfigurationComplete message to the eNodeB, indicating that the resource configuration is 
complete. 

15.The eNodeB sends an Initial Context Setup Response message to the MME, indicating that the UE context setup is complete. 

16:The UE sends a ULInformationTransfer message to the eNodeB. The message contains the Attach Complete and Activate default 
EPS bearer context accept messages at the NAS layer. 


17.The eNodeB sends an uplink direct transfer UPLINK NAS Transport message to the MME. The message contains the Attach Complete 
and Activate default EPS bearer context accept messages at the NAS layer. 


N 
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Overview of RRC Connection Setup 


O RRC connection setup is a process of setting up SRB1. 


O The RRC connection setup cause value is determined by the NAS procedure type. Different NAS procedures 
correspond to different RRC connection setup causes. 


NAS process RRC Connection Setup Cause call type 
Attach MO-signalling originating signalling i 
© TAU  MO“signaling originating signalling 
| Detach Mo-signalling originating signalling 
MO-data [] Request to set up service originating calle 
bearer radio resources [] 9 9 


Service 


MO-data [] Uplink signaling request HEHE 
Request resourced E : ee originating calls 


MT-access [] Responding to paging |] terminating calls 


MO-data [] mobile originating CSFB [] originating calls b 
Y 
ERCE MT-access [] mobile terminating CSFB (J FESSSRBIA RACH MITES 


Request Emer i iginati 
gency [ mobile originating CSFB 
emergency call D emergency calls 


Extended 
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Signaling procedure and key parameters for RRC connection setup 


RRC Connection Request 
UE Identi i 
a Yy (((@))) RRC Connection Setup 
Radio Resource Config Dedicated 
- srb-ToAddModlist 
/ - MAC Main Config 
eNB - SPS Config 
RRC Connection Request - Physical Config Dedicated 
RRC Connection Setup 
RRC Connection Setup Complete 
RRC Connection Setup Complete 
Selected PLMN-Identity 
Registered MME 


Dedicated Info NAS 
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Initial UE Message 


After an RRC connection is set up, the eNodeB receives an RRC Connection Setup Complete 


message Carrying the first uplink NAS message. The eNodeB activates the NAS transmission 


process and sends the first uplink NAS message to the MME in an Initial UE MESSAGE message. 


The S1 signaling connection is set up. 


The Initial UE MESSAGE message carries the following information: 


- EMM[JEPS Mobility Management,” ATTACH REQ” message [] the protocol processes signaling 


related to UE mobility and different ciphering procedures. 


- ESM[]EPS Session Management ,“PDN CONNECTIVITY REQ”message. The protocol processes 


Signaling related to the default bearer and dedicated user pl 


eNodeB 


(((#))) 
Un: RRO NAS S1- MVE: SIAP 
> « 


First UL NAS [J] 


oe 


NAS-PDU 


TAI 


E-UTRAN CGI 

S-TMSI (O) 

CSG Identity (O) 

RRC Establishment cause 
GUMME (O) 
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Authentication and NAS Encryption Process 


e The NAS process is an interaction process between the core network and the UE, including 
authentication and encryption. 


a (po) 
a. The authentication i. Un RRO NAS = EME CIN MME du 


process is used to > a à > Hs) 


derive a new Set of 
keys. 
r Authentication Information Request 
b. The security mode (IMSI, SN ID<MCC & MNC>) 
process IS used to Authentication Information Answer 
make the security (RAND, XRES, AUTN, K ASME) 
context generated PL I nfornati on Transfer 
based on the new key [At henti cati on Request <RAND AUTS) 
take effect. UL Infornati on Transfer 
C. In processes such as (Authentication Answer(RES) y U MS Transfer 
identity, the core DL NS Transfer 
network obtains related {NS Security CormanckE A, EX) 
information from the ~ I nfornati on Transfer 
UE. 
: UL I nf ornati on Transfer 
The NAS process is > ENG Traer 
represented as uplink and Els > 
downlink direct 
transmission messages for 
the eNodeB. 


DL MS Transfer ma 


> 
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Uplink Information Transmission Procedure 


e function 

e This signaling is intended to transfer NAS or (tunneled) non-3GPP indication 
information from the UE to the E-UTRAN. That is, the NAS information needs to 
be transmitted is nested in this message. 

e When NAS or non-3GPP indication information needs to be transmitted, the UE 
initiates the uplink information transmission process by sending a UL 
Information Transfer message. 

e NAS signaling transmission aims to transmit UE-MME signaling over the S1 
interface.The NAS signaling is carried in an IE in the Initial UE MESSAGE, 
DOWNLINK NAS TRANSPORT, or UPLINK NAS TRANSPORT message. 
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Initial context setup procedure 


e After the UE initiates an initial context setup request on the access network side, the core 
network requests the initial context setup. 

e The initial setup procedure establishes a default bearer for the UE. According to 3GPP TS 
23.401, when the UE accesses the PDN for the first time, the EPC needs to allocate the first 
bearer to the UE, and the bearer remains. The UE is disconnected from the PDN. This 


bearer is called the default bearer. 


e In contrast, after the default bearer is established, other bearers established between the 


| 
| the Context Setup e 
3 Response message, the EPC 
must be ready to receive 


| 
| 
| user data on the E-RAB. 
| 
| 


Process of querying UE capabilities 


e When a UE attaches to the network, the 
S1AP INITIAL CONTEXT SETUP REQ message sent by the EPC does not 
contain the UE capability. Instead, the eNodeB initiates a query request 
to the UE, and the UE reports the request to the eNodeB. In addition, the 
eNodeB reports the UE capability indication information to the EPC 
through the S1 interface. 

° During the idle-to-active procedure, the EPC sends the UE capability to 
the eNodeB through the S1AP INITIAL CONTEXT SETUP REQ. The 


eNodeB does not need to query the UE, saving air interface resources. 
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Example of the UE capability query procedure 


struDL-DCCH-Message 
É message 


E c1 


E ueCapabilityEnquiry 
— rre-Transactionldentifier: ---- 
E criticalExtensions 
E ct 


E ueCapabilityEnquiry-r8 


0x2(2) ---- 


RR p* 


E ue- Mn 


RAT-Type: ---- 
RAT-Type: ---- 
— RAT-Type: ---- 
— RAT-Type: ---- 


geran-cs(2) ---- 
geran-ps(3) ---- 


E ueCapabiliyRAT- Container 
Eh ueEutraCap 
=} UE-EUTRA-Capability 
— accessStratumRelease: -- 


o pdcp-Parameters 
phyLayerParameters 
=+ -Parameters 
measParameters 


— interRAT-Parameters: ---- (0) ---- 


0011 
cdma2000-1XRTT(4) ---- 


-- rel9(1} -- 


*000 


E Ir) MME 
8. Un: RRO NAS aa S1- ME: SIAP By 
E RRC:Conn Reg > 
RRC Com Setup 
RRC Conn Setup Cmp 
> Initial UE Msg > 
E Authentication] Security] Identity E 
eg pp La RRC UE Cap Enquiry Li Initial Context Sebup Req 
Sei RRC UE Cap Info > 
regi UE Capability Info Ind GE 
back 0 : ‘ 
s that LTE~ y 
rted. -~ S 
te NI 


After receiving the UE capability 


The UE message, the MME replaces the 
en en previously stored UE capability 
a information. 


11....„2VE Support for Automatic 


Neighbor Relationship (ANR) 
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AS Security Mode Process 


e Purpose: 

° The security mode procedure is used to activate ciphering and integrity protection at the 
access stratum. Only after the AS security function Is activated, a radio bearer other than 
SRB1 can be set up in the RRC Connection Reconfiguration message. 

e Start time: 
e After SRB1 is set up and before SRB2 is set up 


D For integrity protection, the secure mode B. Uu: RRO NAS eu. S1- ME: SIAP 2 
command and the secure mode complete message 
are initiated themselves, and for encryption, the 
next message in the secure mode process is 


initiated. RRC Secur Mode Cmd 
RRC Sear ModeCnp „| 


a Integrity protection applies only to signaling-plane 


SRBs. Encryption applies to signaling-plane SRBs RRC Security Mode Command 
Ciphering Algorithm 
and user-plane DRBs. Integrity Protection Algorithm 
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RRC Connection Reconfiguration Procedure 


In this procedure, the UE configures SRB2 and DRB for the default bearer based on the RRC 
reconfiguration message delivered by the eNodeB and reports an RRC reconfiguration complete 


message to the eNodeB. 
a RRC connection reconfiguration functions: = 


(41) MME 
B. Uu: RRQ NAS = S1- ME: SIAP 
1. Establish, modify, or release a radio bearer. & h > 3) 


IE: radio Resource Config 


2. Perform the handover. 
IE: mobility Controllnformation 


3. Create, change, or release measurement 


configurations. RRC Com Redig 


RRC Conn Recfg Cmp 


IE: meas Config > 
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Paging Procedure 


eNodeB 


i DL Data Notification La GIP-U: Data a 
«Paging 7 
RRC Connection Setup Request 
= RRC Comnection Setup 
RRC Connection Setup Compl HH 
EM Service Request S Sn USE > 
Service 
Requet< nasıoollll | 2... 
q «NASO 000000 _ Initial Context Set R De 
GE ASI DOD irris > 
RRC Connection Reconfiguration 
RRC Connection 


Reconfiguration Complete 


m Initial Context Setup Response 


PDCP: Data 
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Thank You 
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